Releases · aykutkardas/json-function

Repository navigation

v2.0.0 Latest

Latest

aykutkardas released this 03 Oct 20:57

168d92b

See Migrating from 1.x for how to update.

Chaining is immutable. Every method returns a new query, so a chain that is never run can no longer leak into the next query. Calling methods one by one without using the return value no longer builds a query, and the resetRecord option and the option/data properties are removed.
getQuery() returns an ordered array of steps, and steps run in the order they were added. Queries in the 1.x object format are still accepted.
innerJoin is a real inner join: items without a match are dropped, and an item with several matches appears once per match.
where with several queries returns each matching item once, in input order.
search matches the key literally instead of as a regular expression, skips missing fields, and is case sensitive unless caseSensitive: false is passed.
Stricter, generic TypeScript types.
The package is an ES module and requires Node.js 20.19 or later. require("json-function") still works on those versions; on older ones it fails with ERR_REQUIRE_ESM.

leftJoin, with one row per match.
select reads dotted paths with { deep: true }.
Documentation moved from GitBook into the repository (docs/). Its examples are run by the tests.

orderBy no longer sorts the input array in place.
search no longer throws for keys such as "c++", and missing fields no longer match as "undefined".
Keys named __proto__ in data or in select/schema arguments can no longer change object prototypes or Object.prototype.
A saved query no longer drops steps or replays them in a different order.

Queries on large arrays are much faster: property paths, where, search, select and schema are compiled once instead of per item, orderBy reads each sort key once, and chains run filters and limits in one pass and select the top items for orderBy + limit. For example, search on 200,000 items went from 65 ms to 4 ms.

Assets 2

v1.8.40

aykutkardas released this 03 Oct 20:57

f80297c

Security fixes for the 1.x line. Published on npm with the legacy tag; latest is 2.x. Install it with npm install json-function@legacy.

search passed the key to RegExp unescaped. A key such as "(" threw, and a pattern such as "(a+)+$" could hang the process (ReDoS). The key is now matched as plain text, as documented.
transform converted a key such as "____proto____" to "__proto__" and assigned it, so JSON input could replace the prototype of the returned object. The key is now kept as an own property.

Code that relied on search treating the key as a regular expression gets plain-text matching instead. This behavior was never documented.

Both issues are also fixed in 2.0.0.

Full changes: #36

Assets 2